Redirecting HTTP Requests to HTTPS

After you set ManualWorks to handle HTTPS requests, redirect all HTTP requests to HTTPS as follows.

1

Set two Connector tags in the server.xml file

You must set a Connector tag that receives HTTP requests as well as one for HTTPS requests, so that HTTP requests can be changed to HTTPS. Set them as follows.

3RABBITZ_HOME refers to the directory where ManualWorks is installed.

  1. Open the 3RABBITZ_HOME/tomcat/conf/server.xml file.

  2. Set two Connectors that receive HTTP and HTTPS requests, directly under the Service tag.

    • Tags and attributes are case-sensitive.

    • The first Connector tag is for HTTP, and the second is for HTTPS. Change the keystoreFile, keystorePass, and keystoreType attributes of the second Connector tag to match your certificate.

    • In the example, the port of the second Connector tag is 443, the default HTTPS port. To match it, the port of the first Connector tag is 80, the default HTTP port, instead of 1975. Change them to fit your environment.

<Connector port="80" protocol="HTTP/1.1" relaxedQueryChars="^`\|{}[]"
    connectionTimeout="20000" redirectPort="443" URIEncoding="UTF-8"
    maxPostSize="-1" Server="3Rabbitz" />

<Connector port="443" protocol="HTTP/1.1" relaxedQueryChars="^`\|{}[]"
    connectionTimeout="20000" URIEncoding="UTF-8"
    maxPostSize="-1" Server="3Rabbitz"
    SSLEnabled="true" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS"
    keystoreFile="E:\3rabbitz-key\mycert.pfx" 
    keystorePass="1234"
    keystoreType="PKCS12" />

HTTPS settings depend on the certificate you received. We recommend following the Apache Tomcat 9.0 guide from your certificate provider.

  1. Restart ManualWorks.

  2. Check that ManualWorks handles both HTTP and HTTPS requests.

2

Add the security-constraint tag to the web.xml file

3RABBITZ_HOME refers to the directory where ManualWorks is installed.

  1. Open the 3RABBITZ_HOME/tomcat/conf/web.xml file.

  2. Add the security-constraint tag at the end, before the closing web-app tag.

<web-app>
    <!-- content omitted -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>All Requests</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
</web-app>

  1. Restart ManualWorks.

  2. Check that ManualWorks redirects HTTP requests to HTTPS.